RUSTSEC-2022-0102 Out of bounds read/write with zero-memory-pages configuration

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg. For more information see the GitHub-hosted security advisory...

nfprobe (=0.0.1), terminus (>=0.1.0 <=0.2.0) potentially affected by unknown CVE via elf_rs (>=0.1.1 <=0.1.3)

elfrs CARGO version =0.1.1, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0079...

addr2line (=0.7.0), aether (>=0.0.1 <=0.0.3) +360 more potentially affected by unknown CVE via parity-wasm (>=0.17.0 <=0.45.0)

parity-wasm CARGO version =0.17.0, =0.0.1, =0.1.0, =0.26.1, =0.3.10, =0.0.1, =0.0.0, =0.0.1, =0.1.0, =0.4.1, =0.1.0, =0.2.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0061...

RUSTSEC-2022-0095 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x. For more information see the GitHub-hosted security advisory...

a2 (>=0.5.0-alpha.6 <=0.5.0-alpha.7), abci-rs (=0.2.0) +425 more potentially affected by unknown CVE via crossbeam-queue (>=0.1.2 <=0.2.0)

crossbeam-queue CARGO version =0.1.2, =0.5.0-alpha.6, =0.0.2, =0.0.1, =0.1.0-alpha.2, =0.1.5, =0.12.0, =0.5.0, =0.1.0, =0.3.0 - amethyst-navigation =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0021...

a2 (>=0.2.0 <=0.3.6), abc (>=0.1.0 <=0.2.3) +521 more potentially affected by unknown CVE via crossbeam (>=0.1.6 <=0.6.0)

crossbeam CARGO version =0.1.6, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0020...

openssl-sys (>=0.9.35 <=0.9.37) potentially affected by CVE-2022-0778 via openssl-src (=110.0.7+1.1.0i)

openssl-src CARGO version =110.0.7+1.1.0i is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - openssl-sys =0.9.35, =0.9.37 Source cves: CVE-2022-0778 Source advisory: OSV:RUSTSEC-2022-0014...

azoth (=0.1.0), azoth-lmdb (>=0.1.0 <=0.2.5) +26 more potentially affected by unknown CVE via lmdb (>=0.7.2 <=0.8.0)

lmdb CARGO version =0.7.2, =0.1.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.9.3, =0.1.0, =1.3.3, =0.1.0, =0.1.0, =0.5.0, =0.8.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0001...

GSL (>=0.4.25 <=0.4.26), IMAPServer (=0.0.0) +4478 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5 <=0.3.25)

rustc-serialize CARGO version =0.1.5, =0.4.25, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.0.6, =0.1.0, =0.2.1, =0.1.4, =0.1.1, =0.3.0 - ace-test-lib =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0004...

adiscord (>=0.0.1 <=0.0.3), alpaca-data-api (>=0.1.0 <=0.1.2) +20 more potentially affected by unknown CVE via dotenv_codegen (>=0.10.0 <=0.9.3)

dotenvcodegen CARGO version =0.10.0, =0.0.1, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.1.2, =0.7.0, =0.1.0, =0.1.0, =0.3.0 - meep =1.0.1 - ncrsdk =0.1.0 - new-rawr =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0142...

GHSA-V5M7-53CV-F3HX crossbeam-channel Undefined Behavior before v0.4.4

Impact The affected version of this crate's the bounded channel incorrectly assumes that Vec::fromiter has allocated capacity that same as the number of iterator elements. Vec::fromiter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel...

Boa (>=0.4.0 <=0.13.1), HPGO (=0.9.2) +3714 more potentially affected by unknown CVE via serde_cbor (>=0.10.2 <=0.9.0)

serdecbor CARGO version =0.10.2, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =0.4.1, =0.8.0, =0.9.0, =0.1.0, =0.1.0, =1.0.0, =1.0.3 - accurate =0.3.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0127...

RUSTSEC-2021-0103 Partial read is incorrect in molecule

Anyone who uses totalsize.. function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release...

actix-broker (>=0.1.3 <=0.1.7), actix-diesel (>=0.1.0 <=0.3.0) +894 more potentially affected by unknown CVE via cpuid-bool (>=0.1.2 <=0.2.0)

cpuid-bool CARGO version =0.1.2, =0.1.3, =0.1.0, =0.3.0, =0.3.0, =0.5.1, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0064...

binjs_es6 (=0.2.1) potentially affected by CVE-2021-45683 via binjs_io (=0.2.1)

binjsio CARGO version =0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on binjsio and may be impacted: - binjses6 =0.2.1 Source cves: CVE-2021-45683 Source advisory: OSV:RUSTSEC-2021-0085...

a_r_c_h_e_r_y (>=0.4.1 <=0.4.3), abci-storage (=0.0.3) +1686 more potentially affected by unknown CVE via difference (>=0.4.1 <=2.0.0)

difference CARGO version =0.4.1, =0.4.1, =0.1.1, =0.1.0, =0.1.0, =4.1.0, =0.6.0, =0.1.0, =0.1.25, =2.0.0, =2.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0095...

async-coap-tokio (=0.1.0) potentially affected by CVE-2020-36444 via async-coap (=0.1.0)

async-coap CARGO version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on async-coap and may be impacted: - async-coap-tokio =0.1.0 Source cves: CVE-2020-36444 Source advisory: OSV:RUSTSEC-2020-0124...

actyx_sdk (=0.3.0), actyxos_sdk (>=0.5.1 <=0.6.0) +40 more potentially affected by CVE-2020-36471 via generator (=0.6.25)

generator CARGO version =0.6.25 is affected by a known vulnerability. The following packages have a transitive dependency on generator and may be impacted: - actyxsdk =0.3.0 - actyxossdk =0.5.1, =0.1.0, =0.2.0, =0.1.0, =0.1.0-alpha.1, =0.1.0, =0.0.1, =0.2.11, =0.7.0, =0.5.0, =0.9.2, =0.8.2, =0.1....

querylib (>=0.2.0 <=0.5.0) potentially affected by CVE-2020-36458 via lexer (=0.1.18)

lexer CARGO version =0.1.18 is affected by a known vulnerability. The following packages have a transitive dependency on lexer and may be impacted: - querylib =0.2.0, =0.5.0 Source cves: CVE-2020-36458 Source advisory: OSV:RUSTSEC-2020-0138...

maidsafe_client (>=0.1.0 <=0.1.2), maidsafe_types (>=0.0.9 <=0.2.3) +8 more potentially affected by unknown CVE via routing (>=0.0.9 <=0.4.1)

routing CARGO version =0.0.9, =0.1.0, =0.0.9, =0.0.3, =0.1.4, =0.1.0, =0.1.0, =0.1.5, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0076...